The current Aggregate condition is set to COUNT(Matched Events) >= 1, which only triggers the rule after at least one event. To ensure all Modbus messages (including the first one) match the rule, the condition must be >= 0, so every event is considered, including the very first occurrence.

The FortiGuard Operational Technology (OT) Security Service for FortiGate combines IPS and application control signatures tailored to OT environments, enabling detection and protection of OT-specific protocols and threats.
IPS is essential for detecting network-level threats and protocols associated with OT devices including PLCs.
Deep packet inspection (DPI) is part of the traffic analysis process but the primary sensor for detecting specific OT protocols is IPS.
Antivirus and application control are generally less focused on protocol detection for OT networks compared to IPS.

The CMDB (Configuration Management Database) operational reports in FortiSIEM allow you to monitor device performance, health, and status.
Through CMDB, you can check device monitoring status, detect if FortiSIEM is falling behind on data collection, and identify any monitoring errors or failures.
This reporting helps quickly explore issues related to device performance that could put the network at risk.

Automation between FortiAnalyzer and FortiGate relies on event handlers configured on FortiAnalyzer with Automation Stitch enabled, which allows FortiAnalyzer to trigger automated actions on FortiGate when specific events, such as compromised devices, are detected.